Unknown severity · Source severity not reportedCVE-2026-98599

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()CVE-2026-98599

Answer in brief

CVE-2026-98599 records a Unknown severity vulnerability in bpf: Reject non-negative offsets in stack_slot_obj_get_spi(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 18, 2026Updated Oct 19, 2026Source checked Oct 25, 2026First seen by HOL Oct 18, 2026Material review Oct 19, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=06accc8779c1d558a5b5a21f2ac82b0c95827ddd <89a7241fc7ecc1b5e47c3f071081e314523b8d9d \|\| >=06accc8779c1d558a5b5a21f2ac82b0c95827ddd <79a9172f3ab4ad8392c5e5c8944b9b7710ade620	89a7241fc7ecc1b5e47c3f071081e314523b8d9d, 79a9172f3ab4ad8392c5e5c8944b9b7710ade620
Linux/Linuxgeneric	6.4	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 89a7241fc7ecc1b5e47c3f071081e314523b8d9d if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 18, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8. stack_slot_obj_get_spi() currently checks alignment and the resulting spi bounds, but does not reject the non-negative offset itself. It can therefore validate a PTR_TO_STACK register holding fp+0 against an iterator stored at fp-8 even though the runtime receives the actual fp+0 pointer. An effectful iterator kfunc can then interpret memory outside the BPF stack as iterator state. Reject non-negative offsets before converting the offset to an spi. All valid stack objects begin at a negative offset from the frame pointer.

Quoted source text, attributed separately from HOL analysis.